diff --git a/security/openconnect/Makefile b/security/openconnect/Makefile
index 6c5a4b0aaa39..6145c92c005c 100644
--- a/security/openconnect/Makefile
+++ b/security/openconnect/Makefile
@@ -1,63 +1,63 @@
 # Created by: Damian Gerow <dgerow@afflictions.org>
 
 PORTNAME=	openconnect
-PORTVERSION=	8.10
+PORTVERSION=	8.20
 CATEGORIES=	security net-vpn
 MASTER_SITES=	ftp://ftp.infradead.org/pub/openconnect/ \
 		ZI
 
 MAINTAINER=	zi@FreeBSD.org
 COMMENT=	Client for Cisco's AnyConnect SSL VPN
 
 LICENSE=	LGPL21
 LICENSE_FILE=	${WRKSRC}/COPYING.LGPL
 
 LIB_DEPENDS=	libxml2.so:textproc/libxml2
 RUN_DEPENDS=	vpnc-script:sysutils/vpnc-scripts
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--disable-nls --with-vpnc-script=${LOCALBASE}/sbin/vpnc-script \
 		--with-pkgconfigdir=${PREFIX}/libdata/pkgconfig \
 		--without-openssl-version-check --without-libpcsclite \
 		--without-libpskc
 USES=		cpe gmake iconv libtool pkgconfig python:build ssl shebangfix
 CPE_VENDOR=	infradead
 INSTALL_TARGET=	install-strip
 USE_LDCONFIG=	yes
 SHEBANG_LANG+=	SH
 SH_OLD_CMD+=	/system/bin/sh
 SHEBANG_FILES=	trojans/csd-post.sh trojans/csd-wrapper.sh \
 		trojans/tncc-emulate.py \
 		trojans/hipreport-android.sh trojans/tncc-wrapper.py
 PORTDOCS=	*
 
 OPTIONS_DEFINE=	DOCS PROXY GNUTLS GSSAPI LZ4 P11 STOKEN
 OPTIONS_DEFAULT=GSSAPI
 
 LZ4_DESC=		LZ4-based compression
 LZ4_LIB_DEPENDS=	liblz4.so:archivers/liblz4
 LZ4_CONFIGURE_WITH=	lz4
 
 PROXY_DESC=		Automatic proxy configuration via libproxy
 PROXY_LIB_DEPENDS=	libproxy.so:net/libproxy
 PROXY_CONFIGURE_WITH=	libproxy
 
 GNUTLS_DESC=		Use GnuTLS instead of OpenSSL (experimental)
 GNUTLS_LIB_DEPENDS=	libgnutls.so:security/gnutls
 GNUTLS_CONFIGURE_WITH=	gnutls
 
 GSSAPI_CONFIGURE_WITH=	gssapi
 
 P11_DESC=		PKCS \#11 support via libp11
 P11_LIB_DEPENDS=	libp11.so:security/libp11
 
 STOKEN_DESC=		With RSA soft token support via libstoken
 STOKEN_LIB_DEPENDS=	libstoken.so:security/stoken \
 				libtomcrypt.so:security/libtomcrypt
 STOKEN_CONFIGURE_WITH=	stoken
 
 post-install:
 	${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/TODO ${STAGEDIR}${DOCSDIR}
 
 .include <bsd.port.mk>
diff --git a/security/openconnect/distinfo b/security/openconnect/distinfo
index 7df8edbaf509..ba3ee893e685 100644
--- a/security/openconnect/distinfo
+++ b/security/openconnect/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1598282005
-SHA256 (openconnect-8.10.tar.gz) = 30e64c6eca4be47bbf1d61f53dc003c6621213738d4ea7a35e5cf1ac2de9bab1
-SIZE (openconnect-8.10.tar.gz) = 2084534
+TIMESTAMP = 1647961578
+SHA256 (openconnect-8.20.tar.gz) = c1452384c6f796baee45d4e919ae1bfc281d6c88862e1f646a2cc513fc44e58b
+SIZE (openconnect-8.20.tar.gz) = 2651542
diff --git a/security/openconnect/files/patch-stoken.c b/security/openconnect/files/patch-stoken.c
new file mode 100644
index 000000000000..e265f5ef3cd9
--- /dev/null
+++ b/security/openconnect/files/patch-stoken.c
@@ -0,0 +1,22 @@
+--- stoken.c.orig	2021-07-01 20:58:46 UTC
++++ stoken.c
+@@ -100,6 +100,7 @@ static int decrypt_stoken(struct openconnect_info *vpn
+ 
+ 	form.opts = opts;
+ 	form.message = _("Enter credentials to unlock software token.");
++	form.auth_id = "_rsa_unlock";
+ 
+ 	if (stoken_devid_required(vpninfo->stoken_ctx)) {
+ 		opt->type = OC_FORM_OPT_TEXT;
+@@ -206,9 +207,10 @@ static int request_stoken_pin(struct openconnect_info 
+ 
+ 	form.opts = opts;
+ 	form.message = _("Enter software token PIN.");
++	form.auth_id = "_rsa_pin";
+ 
+ 	opt->type = OC_FORM_OPT_PASSWORD;
+-	opt->name = (char *)"password";
++	opt->name = (char *)"pin";
+ 	opt->label = _("PIN:");
+ 	opt->flags = OC_FORM_OPT_NUMERIC;
+ 
diff --git a/security/openconnect/pkg-plist b/security/openconnect/pkg-plist
index 20fbfe078cce..567156d9232a 100644
--- a/security/openconnect/pkg-plist
+++ b/security/openconnect/pkg-plist
@@ -1,14 +1,14 @@
-sbin/openconnect
 include/openconnect.h
 lib/libopenconnect.so
 lib/libopenconnect.so.5
-lib/libopenconnect.so.5.6.0
+lib/libopenconnect.so.5.7.0
 libdata/pkgconfig/openconnect.pc
 libexec/openconnect/csd-post.sh
 libexec/openconnect/csd-wrapper.sh
+libexec/openconnect/hipreport-android.sh
 libexec/openconnect/hipreport.sh
 libexec/openconnect/tncc-emulate.py
 libexec/openconnect/tncc-wrapper.py
 man/man8/openconnect.8.gz
-libexec/openconnect/hipreport-android.sh
+sbin/openconnect
 share/bash-completion/completions/openconnect